CVE-2025-30372 is a critical (CVSS 9.8) SQL injection in Emlog Pro versions pro-2.5.7 and pro-2.5.8. The search controller can be bypassed with double URL encoding, which could leak user database data. Version pro-2.5.9 fixes it. Upgrade after taking a backup, and review search logs for odd requests.
What's affected
Emlog Pro versions pro-2.5.7 and pro-2.5.8 are affected, according to the record and the GitHub advisory. Version pro-2.5.9 fixes the issue.
Emlog is an open source website building system. The affected code is the search controller, reachable through the site's search feature, so public sites are in scope.
The record does not flag the CVE as known exploited, and the CVE is not in the CISA KEV catalog at the time of writing.
How to check if you're exposed
Check the version in your Emlog admin panel or in the project files.
- Open the admin area and look at the version number in the footer or the about page, or check the release you installed.
- If it is pro-2.5.7 or pro-2.5.8, you are affected.
- Search web logs for search requests with unusual encoded characters, including repeated percent encoding, and check database logs for syntax errors.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project's dependency list includes an affected component, and the Gold directory lets you look up the CVE and its related weaknesses.
What to do now
- Upgrade Emlog Pro to pro-2.5.9 or later, after taking a backup.
- Review the search related access logs for suspicious requests.
- Use a database account with the fewest permissions needed.
- Consider rotating administrator passwords if the site holds user accounts and you see suspicious activity.
- Add web application firewall rules for encoded SQL metacharacters as an extra layer, not a substitute.
Why it matters
The record maps the flaw to CWE-89 (SQL Injection). The advisory explains that the search code applied escaping first and then decoded the URL again afterward without escaping a second time. Double encoded input therefore slipped past the escaping and reached the query as live characters.
The order of operations is the lesson. Decoding after sanitizing undoes the sanitizing. Input should be decoded once, at the edge, and then handled with parameterized queries so that escaping order does not matter.
The advisory says the impact is potential leakage of sensitive information from the user database. A search box is a public feature on most sites, so an attacker does not need an account.
Quick check
What is double encoding?
Encoding a character twice, so that a filter sees a harmless form and a later decoding step turns it back into a dangerous one.
Which version fixes it?
pro-2.5.9, according to the advisory and the record.
Sources
Last reviewed: 19 October 2026.
